CVE-2019-7481
SonicWall SMA100 SQL Injection Vulnerability
CVSS
7.5
High
EPSS
99.9%
p100
KEV
YES
Nov 3, 2021
Exploit Today
80
0-100
Published: Dec 17, 2019 · Last modified: Aug 12, 2026 · CWE-89
99.9%EPSS · 30 days99.9%
2026-09-162026-10-14
Product
SonicWall / SMA100
Vulnerability
SonicWall SMA100 SQL Injection Vulnerability
Added to KEV
Nov 3, 2021
Remediate by
May 3, 2022
Known ransomware use
Yes
Summary description
SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2019-7481
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-110840——
——0n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query field, unauthenticated external callers can execute arbitrary SQL against the connected database with the stored credential's privileges.7hCVE-2026-1106707.3 HIG—
——0A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.9hCVE-2026-556849.8 CRI—
——0WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.10hCVE-2026-556839.8 CRI—
——0WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6.10hCVE-2026-556818.8 HIG—
——0WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.10hCVE-2026-556809.8 CRI—
——0WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.10h